AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Audit

  Why it's wrong here

  Audit, while useful for visibility, is purely a logging effect: it evaluates resources against the policy condition and writes compliance details (including the resource name and compliance state) to the activity log. It never invokes any deployment, alters the resource, or creates the missing diagnostics settings. Therefore, after running an audit, the 200 VMs would remain non-compliant with no configuration change, so it does not satisfy the requirement to automatically configure them.

  When this WOULD be correct

  Use Audit when the goal is to monitor and report on compliance status (e.g., which VMs lack diagnostic settings) without automatically remediating, such as for initial compliance assessment or manual remediation tracking.

• ✗

  Deny

  Why it's wrong here

  Deny blocks a resource from being created or updated if it fails the policy condition, but it has no effect on resources already in existence. For these 200 existing VMs, Deny will neither deploy diagnostic settings nor make any post-hoc change; it would only stop future VM deployments that fail the requirement (e.g., a VM created without diagnostic settings would be rejected). Since the task is remediation of existing resources, Deny is insufficient.

  When this WOULD be correct

  A scenario where the compliance team wants to block any new VM deployment that does not include diagnostic settings from the start, such as a policy that denies creation of VMs without a specific tag or configuration.

• ✓

  DeployIfNotExists

  Why this is correct

  DeployIfNotExists is the correct effect because it evaluates each VM for the absence of a diagnostic settings resource and, when non-compliance is detected, deploys that required resource via an ARM template or linked deployment. With a remediation task triggered through Azure Policy – and a system-assigned managed identity granted the necessary permissions – this effect can automatically create diagnostic settings for all 200 existing VMs, fully automating remediation.

• ✗

  Modify

  Why it's wrong here

  Modify is the wrong choice because it can only alter properties on an existing resource, such as tags or configuration fields, but cannot create a separate child resource like Microsoft.Insights/diagnosticSettings. Diagnostic settings are their own resource type that must be deployed, not a settable property on a VM resource, so Modify has no ability to instantiate this child resource. Accordingly, Modify cannot drive the required automatic deployment for the 200 VMs.

  When this WOULD be correct

  If the requirement were to automatically add a specific tag (e.g., 'Environment: Production') to all VMs that are missing it, Modify would be the correct effect because it can alter resource properties without deploying additional resources.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question